[Bro] multiple workers per cluster node
dopheide at ncsa.illinois.edu
Fri Mar 4 20:50:50 PST 2011
Thanks everyone for the replies and suggestions. Apparently I just forgot
to run 'install' after changing the node config which is embarrassing, but
I still find it interesting that they all reacted differently.
For future reference, all of the instances that fail show:
/usr/local/bro/share/bro/broctl/cluster-worker.remote.bro, line 14
(BroCtl::workers[WORKER]): run-time error, no such index
/usr/local/bro/share/bro/broctl/cluster-worker.remote.bro, line 13
$events=Remote::manager_events, $connect=T, $sync=F, $retry=1.0 min,
$class=BroCtl::workers[WORKER]$tag): run-time error, uninitialized list
/usr/local/bro/share/broctl/scripts/run-bro: line 73: 27140 Segmentation
fault (core dumped) nohup $tmpbro $@
From: Justin Azoff <JAzoff at uamail.albany.edu>
Date: Fri, 4 Mar 2011 19:50:23 -0500
To: Dop <dopheide at ncsa.illinois.edu>
Cc: "bro at bro-ids.org" <Bro at bro-ids.org>
Subject: Re: [Bro] multiple workers per cluster node
>On Fri, Mar 04, 2011 at 05:29:40PM -0500, Dop wrote:
>> Hopefully quick question. How would you go about configuring Bro
>> nodes to each run dual clients (one per input interface)?
>> What's strange is that it seems to fail unevenly. Fails totally on 21,
>> partially on 22 and 23, but works on 24. It's always the same nodes
>This should work fine, I run 4 workers on one machine without any
>It sounds like maybe you have some filesystem issues preventing bro from
>What do you have in /usr/local/bro/spool/ for each of the failing nodes?
>Is there anything in the stdout or stderr logs?
>/usr/local/bro/spool/debug.log may also have useful info
>I would focus on the machine that it starts partially on.
>-- Justin Azoff
>-- Network Security & Performance Analyst
More information about the Bro